Your rights under the GDPR
The law is on your side.
The General Data Protection Regulation gives you enforceable rights against any organisation that processes your data. Most people never use them. Companies count on it.
Eleven rights
Know exactly what you’re owed.
These rights apply to every company that offers goods or services in the EU — wherever it is headquartered.
- Art. 13–14
Right to be informed
You must be told, clearly and in advance, who is collecting your data, why, on what legal basis, and for how long.
- Art. 15
Right of access
You may demand a copy of every piece of personal data a company holds about you, plus where it came from and who received it. They have one month.
- Art. 16
Right to rectification
Inaccurate or incomplete data about you must be corrected without undue delay.
- Art. 17
Right to erasure
When data is no longer needed, was processed unlawfully, or you withdraw consent, it must be deleted.
- Art. 18
Right to restriction
While a dispute is resolved, you can require that processing of your data be frozen.
- Art. 20
Right to data portability
You can take your data with you in a structured, machine-readable format.
- Art. 21
Right to object
You can object to processing based on legitimate interests — and to direct marketing at any time, without giving reasons.
- Art. 22
Protection from automated decisions
You have the right not to be subject to decisions with legal or similarly significant effects made solely by algorithm.
- Art. 77
Right to complain
You can lodge a complaint with a data protection supervisory authority, in particular in your country of residence or work.
- Art. 79
Right to a judicial remedy
You can take a controller or processor to court directly — independently of any regulator.
- Art. 82
Right to compensation
Any person who has suffered material or non-material damage from an infringement is entitled to compensation.
Warning signs
Has this happened to you?
If any of these sound familiar, your rights may have been violated — and you may be entitled to compensation.
- A company refused, ignored or only partly answered your access request
- You were notified of a data breach — or learned of one from the press
- You keep receiving marketing after you objected or unsubscribed
- Your data appeared somewhere it never should have been
- You were refused credit, insurance or a job by an automated system
- Your employer monitors you in ways nobody explained
- A website tracked you despite you rejecting cookies
- Health, biometric or other sensitive data about you was disclosed
Before you contact us
Preserve everything.
- Keep every email, letter, notification and screenshot relating to the incident.
- Note the dates — when it happened, when you found out, when you complained.
- Do not accept any settlement or sign any waiver from the company before obtaining advice.
- Be aware of limitation periods. In Germany, the standard limitation period is three years from the end of the year in which the claim arose and you became aware of it. Do not wait.
This page is general information, not legal advice. Every case turns on its facts.
Confidential intake
They took your data. Make them answer for it.
Tell us what happened. Every submission is reviewed in confidence by a qualified data protection lawyer.